GNUCOMO: GNU COmputer MOnitoring

About the project

Welcome to the homepage of Gnucomo, the project to monitor the devices (mostly computers) in your network. The aim of the project is to build a set of applications that will help administrators to monitor networks as a whole for errors, attacks and security-breaches in a very user-friendly way. It resembles an intrusion detection system, but doesn't want to redo the efforts made by other projects. All types of possible entries are used as signals for detection of not normal situations.

The gnucomo mailing-list can be used to ask questions or to join the project.

Goal and used technology

The project tries to achieve the following goals:

• Intrusion detection
• Detecting hacker attempts
• Early detection of system failures
• Exhaustion of system resources
• Capacity planning for future expansion
• Spotting bottlenecks in a system.
• Verifying system integrity
• Assistance with troubleshooting
• Perform post-mortem forensics
• Incident response system.

Gnucomo is licensed according to the GNU Public License V2. We rely on the following free software to perform the tasks needed:

• XML DOC for transforming documentation to several formats like PDF, HTML.
• PostgreSQL for our main database. This is actually BSD-licensed since the revision this license is compatible with the GPL license.
• libpqxx for the C++ interface to the PostgreSQL database server.
• GnuPG for secure transportation of the data when e-mail is used.
• AXE for the C++ modules used gcm_input (the application that read the data into the database.

The core team

The core team has agreed to take responsibilities for parts of the projects.

• Brenno de Winter: Project co-ordination, Website, Documentation, Mailinglist, Gnucomo test-server, Processing raw data in database into readable data.
• Arjen Baart: Code review, XML-settings routines, Client rotation application, Transportation
• Peter Roozemaal: Configuration for gnucomo-clients, security reviews overall architecture
• Edwin Nadorp: Administrators interface
• Andreas Sikkema: Windows logging client

The core team on Gnucomo developer day 1.

Links

Documentation

Gnucomo Development Manifest
Gnucomo Design documentation
Gnucomo User manual

Presentation

Presentation held at the CCAMP in Bocholt on August 22nd 2002.
Presentation (in Dutch) held at the dotnet event in the Amsterdam RAI.

Downloads

All documentation here is in XMLDoc format. Please be aware that this is still work in progress:

• Gnucomo-0.0.1 Oct 05, 2002
• Gnucomo-0.0.2 Nov 20, 2002
• Gnucomo-0.0.3 Dec 06, 2002
• Gnucomo-0.0.4 Feb 06, 2003
• Gnucomo-0.0.5 Feb 21, 2003
• Gnucomo-0.0.6 Jul 15, 2003
• Gnucomo-0.0.7 Aug 14, 2003
• Gnucomo-0.0.8 Sep 04, 2003
• Gnucomo-0.0.9 Dec 24, 2003
• Gnucomo-0.0.10 Oct 19, 2007
• Gnucomo-0.0.11 Nov 22, 2007
• Gnucomo-0.0.12 Dec 12, 2007
• The latest Development snapshot on git://www.andromeda.nl/gnucomo

Other

A mailinglist for development has been created. All announces will be done here.

• Mailing-list

Known problems

Log Nr.	Subject	Synopsis	State	Prior
17	GnuCoMo Computer Monitoring	ERROR in gcm_daemon: Attribute 'source_ip' specified more than once	SOLVED
2	GnuCoMo Computer Monitoring	Log entries rejected by gcm_input	NOTED
5	GnuCoMo Computer Monitoring	List of required and recommended software	ANALYZED
10	GnuCoMo Computer Monitoring	Gcm_input may loose its input message	OPENED
11	GnuCoMo Computer Monitoring	Indicate type of data to gcm_input	OPENED
7	GnuCoMo Computer Monitoring	Notifications page	OPENED
8	GnuCoMo Computer Monitoring	Related log_adv records on a log line	OPENED
9	GnuCoMo Computer Monitoring	Input filename for gcm_input	OPENED